Entwicklerinformationen
|
| e2dbg | The Embedded ELF debugger | Mehr ... |
The Embedded ELF Debugger is the implementation of a new concept of
debugger that run inside the process to be debugged instead of being
an external entity accessing from the outside the target address space.
Instead of using system-specific API such as ptrace, the debugger is
linked into a library that is getting injected in a process using the
LD_PRELOAD environment variable. This makes e2dbg very efficient as it
does not need context switching for inspecting the target process.
The ERESI debugger can also be scripted in the same conditions as a
complete ERESI interpreter is embedded into the debugger.
.
The main features of the Embedded ELF debugger are :
.
* Debugging on dynamic ELF binaries without using ptrace
* Runtime injection of software extension developed in C language.
* Runtime static and extern functions redirection.
* Breakpoints and stepping using the sigaction syscall.
* Possibility of registers reading and writing on such events.
* Instruction tracing until next event.
* Runtime access to the linkmap linked list of the runtime linker.
* Support for debugging of multithread processes.
* Backtracing capabilities including on multithread processes.
* Innovative unintrusive debugging technique : Allocation proxying |
| elfsh | The ELF shell | Mehr ... |
The ELF shell is an interactive, modular, and scriptable ELF
(Executable & Linking Format) machine for static binary instrumentation
of executable files, shared libraries and relocatable ELF objects.
Its innovative features make it usable by reverse engineers and security
analysts for embedded analysis using compiled C code extensions of binary
programs. It features execution flow redirection that allows for dynamic
analyzers generation and binary-level testing. ELFsh is compatible with
kernel hardening patches : It can perform operational modifications on
non-executable stack and heap based systems, and this for multiple
architectures.
.
The main features of the ELF shell are :
.
* Injection of new compiled C code into a binary executable or dynamic
library file.
* Function redirection for all kind of functions.
* Relinking of dynamic or static binary files to add all sorts of
dependences without moving the original address space.
* Full access in read/write mode to the ELF data structures from the
scripting language, including but not limited to:
- The Global Offset Table (.got) section
- The dynamic linking section (.dynamic)
- The constructors (.ctors) and destructors (.dtors) array
- The ELF GNU version tables
- The ELF interpreter (.interp) section
- ELF dynamic and static symbol tables (.dynsym and .symtab)
- ELF relocation tables (.rel(a).*)
- ELF Hash table (.hash)
- All other sections in raw read/write mode using hexadecimal strings |
| eresi | The ERESI Reverse Engineering Software Interface | Mehr ... |
ERESI is a general purpose hybrid framework : it includes both static
analysis and runtime analysis capabilities. These features are accessed
by primitives of the ERESI reverse engineering language which makes the
framework more adaptable to the precise needs of her users. It brings
an environment of choice for program analysis through instrumentation,
debugging, and tracing as it also provides more than ten exclusive major
built-in features . ERESI can also be used for security auditing, hooking,
integrity checking or logging binary programs. The project prones modularity
and reusability of code and allows users to create their own project on top
of the ERESI language interpreter in just a few lines.
.
Among other features, the base code can display program graphs on demand
using its automated flow analysis primitives. The tools are enhanced for
hardened or raw systems which have no executable data segments and no
native debug API or even explicit program information.
|
| etrace | The Embedded ELF tracer | Mehr ... |
The ERESI tracer is an embedded tracer which operates directly
from within the traced the binary itself. We acheive this modus
operandi by using binary module injection and function redirection.
A new binary is created where all functions are hooked so we can
display the program entering and leaving functions. As the tracer
is directly into the traced binary, we gain performance as we don't
need to single-step, in comparison with others tracers relying on a
kernel interface like its ptrace debugging API. Another major
difference is that etrace works on all functions without using a
predefined list, as done by most other tracers. Etrace was designed
for reverse engineering targets with not only glibc functions, but
also a custom function present in your binary or in a specific library.
.
The main features of the ELF tracer (etrace) are :
.
* Command-line tracing on ELF binaries without using ptrace.
* A logical organization of trace events fully integrated in the scripting
language.
* Support debug format information (if available) to display names and types
of function parameters.
* Advanced user control over selection of traced functions with regular
expressions. |
| evarista | Program transformer and data-flow analyzer for binary programs | Mehr ... |
The Evarista analyzer, a work in progress program transformer and
data-flow analyzer for binary programs directly implemented in the
ERESI language. |
| libasm0 | Disassembling engine provided to the ERESI framework | Mehr ... |
Libasm provides rich information on the code of binary files loaded
in the ERESI framework, such as instruction and operands analysis,
semantic attributes for instructions and operands, allowing
straight-forward construction of the Control Flow Graph and the Call
Graph (among others). Libasm relies on a a modular and extensible
handling of instruction formats using the reflective vector data
structure provided by libaspect, which lead to a uniform intregration
of libasm features into the ERESI framework language.
.
Libasm can be used in many operations requesting an access to
instructions information:
.
* Generate listing of instructions for basic blocks or functions
on-demand.
* Helping at building different kind of flow graphs by assigning
semantic attributes to instructions and operands.
* Searching for longuests sequences of valid instruction in a buffer.
* Searching for push or pop sequences in binary code.
* Disassembling Sparc opcodes with IA32 engine to check if code may
be valid on both architecture. |
| libasm0-dev | Disassembling engine provided to the ERESI framework | Mehr ... |
Libasm provides rich information on the code of binary files loaded
in the ERESI framework, such as instruction and operands analysis,
semantic attributes for instructions and operands, allowing
straight-forward construction of the Control Flow Graph and the Call
Graph (among others). Libasm relies on a a modular and extensible
handling of instruction formats using the reflective vector data
structure provided by libaspect, which lead to a uniform intregration
of libasm features into the ERESI framework language.
.
Libasm can be used in many operations requesting an access to
instructions information:
.
* Generate listing of instructions for basic blocks or functions
on-demand.
* Helping at building different kind of flow graphs by assigning
semantic attributes to instructions and operands.
* Searching for longuests sequences of valid instruction in a buffer.
* Searching for push or pop sequences in binary code.
* Disassembling Sparc opcodes with IA32 engine to check if code may
be valid on both architecture.
.
This package contains the development files provided by libasm (the
static library - i.e the .a file - and the libasm headers). |
| libaspect0 | The ERESI aspect library | Mehr ... |
Libaspect is a general purpose low-level library dedicated to feature-based,
aspect-oriented project modeling written in the C language. It is especially
relevant when embedded into a runtime environment such as ERESI, because it
makes the project to become reflective by allowing its uniform internal
structures to be modified directly from the Eresi language provided you
also link with librevm which is the interpreter for such language. Libaspect
also provides facilities for the project to auto-profile itself, which has
a concrete use in fast-diagnostic debugging of the analysis framework.
.
The main features of the ERESI aspects library are :
.
* A generic and extensive API and data structures for using hash tables.
* A generic modeling API and data structure called a reflective vector
aspect for modular feature-based portability system in the project
development.
* A generic macro system and help API for the auto-profiling of program's
functions developed in the C or C++ languages.
* A complete type definition system for the specification of new data types
in the Eresi meta-language and their use in domain specific Intermediate
Representation (IR), with a direct use in the realm of reflection, program
transformation and type-based decompilation. |
| libaspect0-dev | The ERESI aspect library | Mehr ... |
Libaspect is a general purpose low-level library dedicated to feature-based,
aspect-oriented project modeling written in the C language. It is especially
relevant when embedded into a runtime environment such as ERESI, because it
makes the project to become reflective by allowing its uniform internal
structures to be modified directly from the Eresi language provided you
also link with librevm which is the interpreter for such language. Libaspect
also provides facilities for the project to auto-profile itself, which has
a concrete use in fast-diagnostic debugging of the analysis framework.
.
The main features of the ERESI aspects library are :
.
* A generic and extensive API and data structures for using hash tables.
* A generic modeling API and data structure called a reflective vector
aspect for modular feature-based portability system in the project
development.
* A generic macro system and help API for the auto-profiling of program's
functions developed in the C or C++ languages.
* A complete type definition system for the specification of new data types
in the Eresi meta-language and their use in domain specific Intermediate
Representation (IR), with a direct use in the realm of reflection, program
transformation and type-based decompilation.
.
This package contains the development files provided by libaspect (the
static library - i.e the .a file - and the libaspect headers). |
| libe2dbg0 | The Embedded ELF debugger library | Mehr ... |
The Embedded ELF Debugger is the implementation of a new concept of
debugger that run inside the process to be debugged instead of being
an external entity accessing from the outside the target address space.
Instead of using system-specific API such as ptrace, the debugger is
linked into a library that is getting injected in a process using the
LD_PRELOAD environment variable. This makes e2dbg very efficient as it
does not need context switching for inspecting the target process.
The ERESI debugger can also be scripted in the same conditions as a
complete ERESI interpreter is embedded into the debugger.
.
This package contains the shared libraries used by elfsh. |
| libe2dbg0-dev | The Embedded ELF debugger library | Mehr ... |
The Embedded ELF Debugger is the implementation of a new concept of
debugger that run inside the process to be debugged instead of being
an external entity accessing from the outside the target address space.
Instead of using system-specific API such as ptrace, the debugger is
linked into a library that is getting injected in a process using the
LD_PRELOAD environment variable. This makes e2dbg very efficient as it
does not need context switching for inspecting the target process.
The ERESI debugger can also be scripted in the same conditions as a
complete ERESI interpreter is embedded into the debugger.
.
This package contains the development files provided by elfsh (the
static library - i.e the .a file - and the elfsh headers). |
| libedfmt0 | The ERESI debug format library | Mehr ... |
Libedfmt is the component dedicated for debug formats parsing. This
library simplifies the handling of debug formats that has a different
organization, requires a different parser, and even contain different
information, and provides a uniform representation which contains common
and important information. This library opens the door to automatic debug
format reconstruction in a unified representation. We currently support
conversions from stabs and dwarf2 formats to the ERESI debug format but
also store results of our automatic analysis in there for future consultation.
.
The main features of the ERESI debug format library are :
.
* Create an uniform format representation for each supported debug format.
* Export types in the ERESI engine indicated by debug information.
* Annotate global variables of the analyzed program using their type
information in the ERESI engine.
* Gives function prototypes to Etrace. |
| libedfmt0-dev | The ERESI debug format library | Mehr ... |
Libedfmt is the component dedicated for debug formats parsing. This
library simplifies the handling of debug formats that has a different
organization, requires a different parser, and even contain different
information, and provides a uniform representation which contains common
and important information. This library opens the door to automatic debug
format reconstruction in a unified representation. We currently support
conversions from stabs and dwarf2 formats to the ERESI debug format but
also store results of our automatic analysis in there for future consultation.
.
The main features of the ERESI debug format library are :
.
* Create an uniform format representation for each supported debug format.
* Export types in the ERESI engine indicated by debug information.
* Annotate global variables of the analyzed program using their type
information in the ERESI engine.
* Gives function prototypes to Etrace.
.
This package contains the development files provided by libedfmt (the
static library - i.e the .a file - and the libedfmt headers). |
| libelfsh0 | The ELF shell library | Mehr ... |
The ELF shell library is the binary manipulation library of the ELF
shell. It contains primitives for static on-disk modifications and
consultation of binary programs linked within the Executable &
Linking Format (ELF) 32bits or 64bits.
.
The main features of the ELF shell library are :
.
* Full API for all ELF structures.
* ET_REL injection into ET_EXEC/ET_DYN ELF files.
* ALTGOT redirection technique, for external functions redirections on RISC
architectures.
* ALTPLT redirection technique, for external functions redirections.
* CFLOW redirection technique, for internal functions redirections.
* EXTPLT partial relinking technique, for adding unknown extern symbols to
the program.
* EXTSTATIC static file relinking technique.
* Partial SHT reconstruction technique.
* PaX protection attributes access in RW mode.
* Core files manipulation. |
| libelfsh0-dev | The ELF shell library | Mehr ... |
The ELF shell library is the binary manipulation library of the ELF
shell. It contains primitives for static on-disk modifications and
consultation of binary programs linked within the Executable &
Linking Format (ELF) 32bits or 64bits.
.
The main features of the ELF shell library are :
.
* Full API for all ELF structures.
* ET_REL injection into ET_EXEC/ET_DYN ELF files.
* ALTGOT redirection technique, for external functions redirections on RISC
architectures.
* ALTPLT redirection technique, for external functions redirections.
* CFLOW redirection technique, for internal functions redirections.
* EXTPLT partial relinking technique, for adding unknown extern symbols to
the program.
* EXTSTATIC static file relinking technique.
* Partial SHT reconstruction technique.
* PaX protection attributes access in RW mode.
* Core files manipulation.
.
This package contains the development files provided by elfsh (the
static library - i.e the .a file - and the elfsh headers). |
| libetrace0 | The ERESI tracer library | Mehr ... |
Libetrace is a collection of generic routines to deal with program traces.
It was unmerged from libelfsh which now only contains ELF dependent code. |
| libetrace0-dev | The ERESI tracer library | Mehr ... |
Libetrace is a collection of generic routines to deal with program traces.
It was unmerged from libelfsh which now only contains ELF dependent code.
.
This package contains the development files provided by libetrace (the
static library - i.e the .a file - and the libetrace headers). |
| libmjollnir0 | Flow analysis and fingerprinting component of the ERESI framework | Mehr ... |
Libmjollnir it is the main receipt of all the original API for code
analysis in ERESI. It can do a control flow graphs and call graphs with
function pointers, perform an 'unstrip', fingerprint functions using
hashing algorithms like MD5 and prepare control flow and function call
graphs which can be accessed by containers API.
.
The main features of this library are :
.
* API and generic container data structures for binary analysis.
* Construction of Control Flow Graphs.
* Construction of Call graphs.
* Fingerprinting of function blocks using hashing algorithms.
* 'Recovery' (unstrip without original names) of the symbol table.
* Function pointers recognition.
* Entry Point Fingerprinting. |
| libmjollnir0-dev | Flow analysis and fingerprinting component of the ERESI framework | Mehr ... |
Libmjollnir it is the main receipt of all the original API for code
analysis in ERESI. It can do a control flow graphs and call graphs with
function pointers, perform an 'unstrip', fingerprint functions using
hashing algorithms like MD5 and prepare control flow and function call
graphs which can be accessed by containers API.
.
The main features of this library are :
.
* API and generic container data structures for binary analysis.
* Construction of Control Flow Graphs.
* Construction of Call graphs.
* Fingerprinting of function blocks using hashing algorithms.
* 'Recovery' (unstrip without original names) of the symbol table.
* Function pointers recognition.
* Entry Point Fingerprinting.
.
This package contains the development files provided by libmjollnir
(the static library - i.e the .a file - and the libmjollnir headers). |
| librevm0 | The Reverse Engineering Vector Machine | Mehr ... |
Librevm is a compact library that includes the Eresi interpreter. REVM
is a central piece of software in the ERESI framework as it exports a
complete API for interpreting programs written in the Eresi language
independently of the binary format, architecture, or Operating System
environment.
.
The main features of the REVM library are :
.
* A complete interpreter of the Eresi language (foreach, match, gotos,
arithmetics ..)
* Generation of graphviz input files from Control Flow Graphs (CFG) and
Call Graphs of analyzed binary programs, using the analysis API of the
Eresi component libmjollnir.
* Full resolved disassembling of sections, functions, or basic blocks,
using features from the Eresi disassembly engine libasm.
* A configuration system allowing user variables, for personalizing the
REVM behavior for your own convenience.
* A generic API of Eresi commands to manage prompt, workspaces, and
terminal colors.
* A generic module system for dynamically loaded Eresi extensions.
* Handling of I/O for receiving commands from readline or from the
network (optional).
* Capability of logging work sessions on disk for future consultation. |
| librevm0-dev | The Reverse Engineering Vector Machine | Mehr ... |
Librevm is a compact library that includes the Eresi interpreter. REVM
is a central piece of software in the ERESI framework as it exports a
complete API for interpreting programs written in the Eresi language
independently of the binary format, architecture, or Operating System
environment.
.
The main features of the REVM library are :
.
* A complete interpreter of the Eresi language (foreach, match, gotos,
arithmetics ..)
* Generation of graphviz input files from Control Flow Graphs (CFG) and
Call Graphs of analyzed binary programs, using the analysis API of the
Eresi component libmjollnir.
* Full resolved disassembling of sections, functions, or basic blocks,
using features from the Eresi disassembly engine libasm.
* A configuration system allowing user variables, for personalizing the
REVM behavior for your own convenience.
* A generic API of Eresi commands to manage prompt, workspaces, and
terminal colors.
* A generic module system for dynamically loaded Eresi extensions.
* Handling of I/O for receiving commands from readline or from the
network (optional).
* Capability of logging work sessions on disk for future consultation.
.
This package contains the development files provided by librevm (the
static library - i.e the .a file - and the librevm headers). |
| libstderesi0 | The ERESI standard library | Mehr ... |
Libstderesi is a collection of 100+ builtin commands shared between many
ERESI components. It was unmerged from librevm which is now only holding
the ERESI language interpreter. |
| libstderesi0-dev | The ERESI standard library | Mehr ... |
Libstderesi is a collection of 100+ builtin commands shared between many
ERESI components. It was unmerged from librevm which is now only holding
the ERESI language interpreter.
.
This package contains the development files provided by libstderesi (the
static library - i.e the .a file - and the libstderesi headers). |
| libui0 | The ERESI user interface | Mehr ... |
| Libui is the user interface of the ERESI project based on readline. |
| libui0-dev | The ERESI user interface | Mehr ... |
Libui is the user interface of the ERESI project based on readline.
.
This package contains the development files provided by libui (the
static library - i.e the .a file - and the libui headers). |
